[atulsian]

How are they planning to block VPNs? Just blocking access to the sites will not help. Blocking VPN is not easy. Look at China, even with the great firewall(GFW) they are still trying to block different protocols and the workarounds are still working fine.

[raksrules]

Originally Posted by atulsian

How are they planning to block VPNs? Just blocking access to the sites will not help. Blocking VPN is not easy. Look at China, even with the great firewall(GFW) they are still trying to block different protocols and the workarounds are still working fine.

I have heard from people using Jio Fiber that certain (popular?) VPNs are blocked.

[atulsian]

Originally Posted by raksrules

I have heard from people using Jio Fiber that certain (popular?) VPNs are blocked.

Sir, it depends on the protocol/port which you are using on the vpn. Also, afaik Jio network mostly runs on ipv6 (including DNS) and therefore any vpn provider which blocks Ipv6 leak or doesn't provide ipv6 service gets blocked. I have seen this on my adblock server which runs on ipv4 and as mentioned above, it fails on Jio network.

[BRV]

New VPN Rules from June / July

This is how it works. For now, what India has done -- citing national security -- is to put fetters on VPN services in the country. It has asked VPNs to:

-- Validated names of subscribers and customers hiring the services
-- Period of hire including dates
-- IPs allotted to (or) being used by VPN users
-- Email address and IP address and time stamp used at the time of registration
-- Purpose of using VPN services
-- Validated address and contact numbers
-- Ownership pattern of the VPN subscribers

Source:

https://www.indiatoday.in/technology...613-2022-05-10

https://economictimes.indiatimes.com...w/91454501.cms

[binand]

Originally Posted by BRV

New VPN Rules from June / July

The commercial VPN providers' USP is that they do not even have the technical capabilities to comply with such requests. So this is a non-starter.

And corporate users - it will be fun. The IT industry depends on VPNs like the automobile industry on steel. Outright ban is very unlikely.

[raksrules]

Originally Posted by BRV

New VPN Rules from June / July



Source:

https://www.indiatoday.in/technology...613-2022-05-10

https://economictimes.indiatimes.com...w/91454501.cms

I am guessing most people who use VPN in India, may be connecting to a non-India server. Now the VPN providers who have servers in India may remove those servers which will impact more to people living in other countries in accessing Indian websites and apps that need a user to be in India.
I am not very sure why a user may be sitting in India and accessing Indian VPN server (apart from privacy concerns).

But say I am in need of VPN to get a Non-Indian IP, I can buy the VPN from any of these providers by paying in dollars or whatever and connect and they would have no need to keep my information as they may not have servers in India anyways.

About corporate VPN, they cannot even touch it. The IT Industry heavy relies on VPN but yes many are moving to VDI at least for client access.

On top of this, people who have knowledge about VPN, and are using android devices, they will just avoid buying VPN and download some cracked app (there are plethora) and continue using it without worrying about anything.

[NaXal]

Hello,

Originally Posted by raksrules

On top of this, people who have knowledge about VPN, and are using android devices, they will just avoid buying VPN and download some cracked app (there are plethora) and continue using it without worrying about anything.

Things aren't that simple anymore.

Machine Learning has progressed a lot. Although they aren't able to crack open an encrypted traffic stream but there are highly advance technologies like Deep Packet Inspection to sperate normal https traffic and VPN traffic flow.

ISPs can identify VPN traffic and take action accordingly. To my personal experience, all of them are abusing this technology to throttle VPN traffic. So when the time comes, if Govt issues directive, they can easily identify individual customers on VPN or simply block the traffic.

About corporate VPN, they cannot even touch it. The IT Industry heavy relies on VPN but yes many are moving to VDI at least for client access.

Another way to segregating Domestic and Corp connection and making more money by asking users to switch to Corp plan with no VPN blocks.

Our Net Neutrality law can rest in peace.

Thanks.

[pandabear]

Working in the same industry so I assume I am qualified to throw in my two cents. Just remember your data is more vulnerable with the VPN provider than your ISP I would never trust any VPN provider with bank transactions and other important stuff; on the other hand data through your ISP is safe. We don't need VPN unless you have very specific use cases to bypass, the internet is completely free in India very few sites are blocked and that too with a specific reason. Never feel the need for VPN when I am in India.

If you feel vulnerable browsing from a public hotspot I would suggest setting up your view own VPN server. It is very easy and can be done in a couple of minutes.

Just remember most VPN providers are very small in revenue compared to the size of ISPs and take care you and your data does not become their product

Originally Posted by theredliner

India is a joke even by banana republic standards. They bring in all the nanny state rules from China, western countries (not talking about VPN wrt the west) etc without bringing any of the facilities/infrastructure those places have. Seriously, what's the incentive for anyone to live here barring a few rich?

I am sorry this is an extremely baseless and loose statement, having lived in multiple countries I can easily say that amount of freedom we enjoy in India is something we take for granted. Just remember that is no net neutrality, no free media, no free love anywhere in the world, it is a myth, again there is no privacy on the internet across the world.

Just don't fall for media propaganda. Example: Remember the propaganda against aadhar is to how insecure it is; well all fears seem to have vanished now, i just call these as election season winds.

My apologies for this contrarian view.

[binand]

Originally Posted by NaXal

Although they aren't able to crack open an encrypted traffic stream but there are highly advance technologies like Deep Packet Inspection to sperate normal https traffic and VPN traffic flow.

This statement is slightly misleading. While DPI as a technology exists (and has been around for a while), it cannot look at the traffic payload and determine whether it is "normal" or "VPN" traffic. The effect of encryption is that an encrypted stream does not look like anything at all - not even itself - so it cannot be analysed to draw conclusions about what is being encrypted. Devices that claim to identify and segregate VPN traffic from non-VPN traffic do so by doing shallow packet inspection: only looking at the packet headers ("metadata") and matching with known VPN providers IP addresses etc.

Originally Posted by NaXal

ISPs can identify VPN traffic and take action accordingly.

Therefore this becomes misleading too. If you don't use any of the signature VPN payloads then ISPs can do jack s. about it.

Originally Posted by NaXal

Another way to segregating Domestic and Corp connection and making more money by asking users to switch to Corp plan with no VPN blocks.

And I hope it never comes to this. This has the potential to kill the startup culture / WFH culture. The big software companies often buy bandwidth from international providers and not from our homegrown ISPs. They will not be affected by such a move but a 5-person remote workforce startup with VPN access to their AWS cloud will bear the brunt.

Originally Posted by pandabear

Just remember your data is more vulnerable with the VPN provider than your ISP I would never trust any VPN provider with bank transactions and other important stuff; on the other hand data through your ISP is safe.

Please qualify this statement. In both cases we only have what the provider chooses to disclose to us; but in the ISP case we have ample evidence they abuse the trust we place in them (Shady Business: Airtel & MTNL injecting advertisements / js into websites you visit!).

[pandabear]

Originally Posted by binand

Please qualify this statement. In both cases we only have what the provider chooses to disclose to us; but in the ISP case we have ample evidence they abuse the trust we place in them (Shady Business: Airtel & MTNL injecting advertisements / js into websites you visit!).

Like I said, your data is not private once it leaves your computer (actually these days it should read as "mind" ) , what matters is just how your data is being put to use. If it is used to show ads including targeted ads, I guess we all are used to it now. In fact we do not have any GDPR equivalent enforced here in India and we consent to cookies and what not. The amount of data shady phone apps steal is a nightmare we all are not even aware of. I would be more alarmed at these rather than the DPI done by ISPs.

What would be more alarming is identity theft and impersonation, credit card theft etc which fall into the criminal setup if shady VPNs decide to sell the data. I am not saying all do, but yeah I would not risk. Your ISP is bound by laws, your VPN provider is not. This is the basic difference.

If something is free you are the product - as I read somewhere.

[theredliner]

Originally Posted by pandabear

I am sorry this is an extremely baseless and loose statement, having lived in multiple countries I can easily say that amount of freedom we enjoy in India is something we take for granted.

Just don't fall for media propaganda. Example: Remember the propaganda against aadhar is to how insecure it is; well all fears seem to have vanished now, i just call these as election season winds.

You clearly didn't read my post as you totally missed the context where I talked about how the govt is copying the restrictions on citizens from other countries while totally washing off their own responsibilities to the citizens unlike the govts of those same countries.

If you are going to call my post baseless, and loose statement based on just your own experience without reading my post properly, well, feel free to do so.

On topic though, do you really think our data is safe with the ISPs? In a country with zero privacy laws and where even the government sells user data without even notifying the users and nobody batting an eyelid, it would be totally naive to assume that.

BTW, I'm not a noob in the area of internet privacy or security to fall for media narratives. The Aadhaar that you seem to think so highly of, has been used by the govt to create a biometric backed health ID of citizens slyly without their explicit permission using the excuse of COVID vaccination. Such things are impossible even in many other banana republics, forget any half decent lawful country. To add to that, all that data are handled by the same CoWIN portal that the govt supposedly has no idea about who actually developed it
https://www.deccanherald.com/nationa...ti-941608.html


BTW, this is how much UIDAI cares about Aadhaar security.
https://www.deccanherald.com/state/t...t-1084246.html

If they are going to deny the theft of their physical devices, do you think they'd admit to any sort of data breach?

I'm also a bit surprised to see you mentioning that you work in the area of VPNs as you're the first person I met working in the area of security/privacy outside the UIDAI team who has so much trust on the Aadhaar system

[binand]

The problem is, these two contradict each other:

Originally Posted by pandabear

In fact we do not have any GDPR equivalent enforced here in India...

Originally Posted by pandabear

Your ISP is bound by laws...

India has no data protection laws, you are right - but that must result in the prudent ones not trusting Indian service providers, not in tying their lots with them.

Originally Posted by pandabear

What would be more alarming is identity theft and impersonation, credit card theft etc which fall into the criminal setup if shady VPNs decide to sell the data. I am not saying all do, but yeah I would not risk.

The VPN provider (or ISP in case of no VPN) does not have access to the credit card number if the underlying channel is correctly encrypted as per industry best practices. This is a bogeyman.

[binand]

Looks like it could be certainly the end of the road for consumer VPN in India:

https://techcrunch.com/2022/05/18/in...pite-concerns/

[R2D2]

Surfshark in discussion with Indian lawyers, may challenge validity of CERT-In directions

Rather ironic because Surfshark has been asking for PAN #s for subscribers from India. I did not renew my subs early this year due to this issue.

Now that the Govt has mandated a KYC and other silly demands (Western Govts also request especially the 5 eye countries) it is most likely that consumer VPNs will shut down their India nodes. As for purchasing VPN subs, it is not like we are absolutely anonymous even today. My VPN purchases can be traced via credit cards. Well, there are workarounds to this for a privileged few i.e. those with BTC and other cryptos.

Where is this heading? Frankly I think towards a ban or heavy restrictions on purchase of VPN subs. There was a recommendaton to this effect by a parliamentary panel headed by an MP and famous lawyer only last year. Indian Govt thinking is rather simple..if you cannot control it just ban it.

[RM Motorsports]

ExpressVPN on Thursday announced that it has removed its virtual private network (VPN) servers in India in response to the recent directions given by the government to make it mandatory for VPN service providers to keep user data for at least five years and share records with authorities when required.

It is important to point out that alongside ExpressVPN, NordVPN parent Nord Security, Surfshark, and ProtonVPN had raised concerns over the Indian government's directive. Nord Security also hinted that it might remove its servers from India if no other options were left.

https://gadgets360.com/internet/news...home-ndtv_tech